We exist because privacy stopped being the default.
NULLSEC is a distributed collective of security researchers, privacy engineers and former incident responders. No headquarters, no investors, no ad model — just a shared conviction that people and organizations deserve to control their own data, and the skill to actually make that true instead of just promising it.
Started as a research group. Stayed independent on purpose.
NULLSEC began as a small group trading notes on exposed infrastructure and careless data handling across the industry. What we kept finding — logging by default, telemetry no one reads, "temporary" data retention that never ends — convinced us privacy needed to be treated as an engineering discipline, not a checkbox in a settings menu. Turns out most of the industry never got that memo. We're still waiting for the rest to catch up.
Independence
No outside funding that could quietly redirect priorities. We answer to the people we protect, not to shareholders — and certainly not to whoever's asking us to look the other way.
Verification
We don't ask you to trust our claims. Every method we use is documented, and every audit is reproducible. Doubt us; we'll wait.
Restraint
The most secure data is data that was never collected. We design for the smallest possible footprint, always — the rest of the industry calls this "leaving money on the table."
Small cells. Clear scope. No noise.
We're not interested in being seen. We're interested in what stays unseen because we did our job.— NULLSEC Collective